devframe 0.8.2 → 0.9.0-beta.10

package/dist/wire-codec-0K-o5MYW.mjs

@@ -0,0 +1,56 @@
+import { n as strictJsonStringify } from "./serialization-BGzEwAdr.mjs";
+import { n as structuredCloneStringify, t as structuredCloneParse } from "./structured-clone-CbAV5rFI.mjs";
+//#region src/rpc/wire-codec.ts
+const EMPTY_WIRE_DEFS = /* @__PURE__ */ new Map();
+/**
+* Build the per-connection wire codec every live transport (WS server, WS
+* client, SSE server, SSE client) shares: per-method dispatch between strict
+* JSON (methods declared `jsonSerializable: true`) and `s:`-prefixed
+* structured-clone (everything else, including all error envelopes), with a
+* request-id → method map so a response independently picks the same
+* encoder as its request. One codec per connection — request-id spaces
+* don't collide across connections.
+*
+* @internal
+*/
+function createRpcWireCodec(definitions = EMPTY_WIRE_DEFS) {
+	const pendingRequestMethods = /* @__PURE__ */ new Map();
+	return {
+		serialize: (msg) => {
+			let method;
+			if (msg.t === "q") method = msg.m;
+			else {
+				method = pendingRequestMethods.get(msg.i);
+				pendingRequestMethods.delete(msg.i);
+			}
+			if (!(msg.t === "s" && "e" in msg) && !!method && definitions.get(method)?.jsonSerializable === true) return strictJsonStringify(msg, method ?? "");
+			return `s:${structuredCloneStringify(msg)}`;
+		},
+		deserialize: (raw) => {
+			const msg = raw.startsWith("s:") ? structuredCloneParse(raw.slice(2)) : JSON.parse(raw);
+			if (msg.t === "q" && msg.i && msg.m) pendingRequestMethods.set(msg.i, msg.m);
+			return msg;
+		}
+	};
+}
+/**
+* Peek at a wire frame's birpc envelope without engaging a codec's
+* request-id bookkeeping — used by the SSE transport to route a frame
+* (park a POST for its response / answer with a bare 202) before it is
+* handed to birpc proper.
+*
+* @internal
+*/
+function peekRpcWireFrame(raw) {
+	try {
+		const msg = raw.startsWith("s:") ? structuredCloneParse(raw.slice(2)) : JSON.parse(raw);
+		return {
+			t: msg?.t,
+			i: msg?.i
+		};
+	} catch {
+		return {};
+	}
+}
+//#endregion
+export { peekRpcWireFrame as n, createRpcWireCodec as t };

package/dist/{ws-client-B6Tnr0ic.d.mts → ws-client-DhjNyQo3.d.mts}

@@ -1,4 +1,4 @@
-import { v as RpcFunctionDefinitionAny } from "./types-CnJSgRVa.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-Djq7CBXh.mjs";
 import { ChannelOptions } from "birpc";
 //#region src/rpc/transports/ws-client.d.ts
 interface WsRpcChannelOptions {
@@ -19,7 +19,12 @@ interface WsRpcChannelOptions {
 /**
  * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
  * Pass the result straight to `createRpcClient`'s `channel` option.
+ *
+ * Also returns `close()`, closing the underlying socket — mirroring the server transport's
+ * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
  */
-declare function createWsRpcChannel(options: WsRpcChannelOptions): ChannelOptions;
+declare function createWsRpcChannel(options: WsRpcChannelOptions): ChannelOptions & {
+  close: () => void;
+};
 //#endregion
 export { createWsRpcChannel as n, WsRpcChannelOptions as t };

package/dist/ws-server-BdSLrhxE.mjs

@@ -0,0 +1,267 @@
+import "./constants.mjs";
+import { t as createRpcWireCodec } from "./wire-codec-0K-o5MYW.mjs";
+import { n as randomToken, r as timingSafeEqual } from "./crypto-token-XCqTSMg9.mjs";
+import { createServer } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import crossws from "crossws/adapters/node";
+//#region src/rpc/transports/session.ts
+let sessionId = 0;
+/**
+* Mint the per-connection session meta every transport binding shares —
+* one id space across transports, so session bookkeeping (streaming
+* subscriptions, shared-state sync, auth trust) never collides between a
+* WS peer and an SSE session on the same server.
+*/
+function createRpcSessionMeta() {
+	return {
+		id: sessionId++,
+		subscribedStates: /* @__PURE__ */ new Set()
+	};
+}
+//#endregion
+//#region src/rpc/transports/ws-server.ts
+/**
+* Create a live, token-protected origin allowlist for external browser
+* viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
+* `registerFromUrl()` in the connection metadata handler to authorize a
+* viewer without sharing a mutable array or disabling DNS-rebinding protection.
+*/
+function createWsOriginRegistry(options = {}) {
+	const token = randomToken();
+	const origins = new Set(options.allowedOrigins ?? []);
+	function normalizeOrigin(origin) {
+		if (!origin) return;
+		try {
+			const url = new URL(origin);
+			const normalized = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
+			return origin === normalized ? normalized : void 0;
+		} catch {}
+	}
+	function registerOrigin(origin, candidateToken) {
+		const normalized = normalizeOrigin(origin);
+		if (!normalized || !candidateToken || !timingSafeEqual(token, candidateToken)) return false;
+		if (options.validateOrigin && !options.validateOrigin(normalized)) return false;
+		origins.add(normalized);
+		return true;
+	}
+	return {
+		token,
+		registerFromUrl(url) {
+			let parsed;
+			try {
+				parsed = new URL(url, "http://localhost");
+			} catch {
+				return;
+			}
+			const origin = parsed.searchParams.get("devframe_viewer_origin") ?? void 0;
+			return registerOrigin(origin, parsed.searchParams.get("devframe_viewer_origin_token") ?? void 0) ? origin : void 0;
+		},
+		isAllowed(origin) {
+			return isAllowedOrigin(origin, [...origins]);
+		}
+	};
+}
+const EMPTY_DEFS = /* @__PURE__ */ new Map();
+function NOOP() {}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => reject(error);
+		server.once("error", onError);
+		try {
+			server.listen(port, host, () => {
+				server.off("error", onError);
+				resolve();
+			});
+		} catch (error) {
+			server.off("error", onError);
+			reject(error);
+		}
+	});
+}
+/** Compare two URL paths ignoring a trailing slash. */
+function pathMatches(a, b) {
+	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+	return strip(a) === strip(b);
+}
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost") || h.startsWith("127.");
+}
+/**
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else — a real remote page in the dev's
+* browser — is rejected.
+*/
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+function isWsOriginRegistry(value) {
+	return !!value && !Array.isArray(value);
+}
+/**
+* Build the `upgrade` listener that hands a request to the crossws adapter,
+* optionally filtered to a single `path`. Non-matching requests are left
+* untouched so other upgrade listeners (e.g. a Vite dev server's HMR socket)
+* can claim them, unless `destroyUnmatched` is set.
+*/
+function createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins) {
+	return (req, socket, head) => {
+		socket.on("error", () => {});
+		if (path) {
+			let pathname = req.url ?? "/";
+			try {
+				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+			} catch {}
+			if (!pathMatches(pathname, path)) {
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
+				}
+				return;
+			}
+		}
+		const originAllowed = isWsOriginRegistry(allowedOrigins) ? allowedOrigins.isAllowed(req.headers.origin) : isAllowedOrigin(req.headers.origin, allowedOrigins || []);
+		if (allowedOrigins !== false && !originAllowed) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		ws.handleUpgrade(req, socket, head);
+	};
+}
+/**
+* The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
+* any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
+* feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
+* fetch-upgrade adapter) reuse the same hooks so every transport speaks the
+* identical wire protocol — one birpc channel per peer, per-method
+* `jsonSerializable` dispatch between strict JSON and structured-clone.
+*/
+function createWsRpcPeerHooks(rpcGroup, options = {}) {
+	const { onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const states = /* @__PURE__ */ new WeakMap();
+	return {
+		open: (peer) => {
+			const meta = createRpcSessionMeta();
+			meta.peer = peer;
+			const connection = {
+				id: meta.id,
+				transport: "websocket",
+				request: peer.request,
+				send: (data) => peer.send(data),
+				close: (code, reason) => peer.close(code, reason),
+				peer
+			};
+			const codec = createRpcWireCodec(definitions);
+			const state = {
+				meta,
+				connection,
+				channel: void 0
+			};
+			const channel = {
+				post: (data) => {
+					peer.send(data);
+				},
+				on: (fn) => {
+					state.onMessage = fn;
+				},
+				serialize: serializeOverride ?? codec.serialize,
+				deserialize: deserializeOverride ?? codec.deserialize,
+				meta
+			};
+			state.channel = channel;
+			states.set(peer, state);
+			rpcGroup.updateChannels((channels) => {
+				channels.push(channel);
+			});
+			onConnected(connection, meta);
+		},
+		message: (peer, message) => {
+			states.get(peer)?.onMessage?.(message.text());
+		},
+		close: (peer) => {
+			const state = states.get(peer);
+			if (!state) return;
+			states.delete(peer);
+			rpcGroup.updateChannels((channels) => {
+				const index = channels.indexOf(state.channel);
+				if (index >= 0) channels.splice(index, 1);
+			});
+			onDisconnected(state.connection, state.meta);
+		}
+	};
+}
+/**
+* Attach a WebSocket transport to an existing RPC group, powered by
+* [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
+* `server` (sharing its port, optionally scoped to a `path`), or let this
+* helper create a standalone server from `port` / `host` / `https`.
+*
+* Returns the crossws node adapter, standalone-server readiness/address
+* accessors, `detach` (remove the upgrade listener from a shared `server`),
+* and `close` (full deterministic teardown).
+*/
+function attachWsRpcTransport(rpcGroup, options = {}) {
+	const { server, port, host = "localhost", path, destroyUnmatched = false, unbound, https, allowedOrigins } = options;
+	const ws = crossws({ hooks: createWsRpcPeerHooks(rpcGroup, options) });
+	const sharedUpgradeListener = createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins);
+	const ownedUpgradeListener = createUpgradeListener(ws, path, true, allowedOrigins);
+	/** Bind a server's `upgrade` events, tracked so `close()` detaches them. */
+	const attachments = /* @__PURE__ */ new Set();
+	function attachTo(target, listener) {
+		target.on("upgrade", listener);
+		const detachOne = () => {
+			target.off("upgrade", listener);
+			attachments.delete(detachOne);
+		};
+		attachments.add(detachOne);
+		return detachOne;
+	}
+	let ready = Promise.resolve();
+	let ownedServer;
+	if (unbound) {} else if (server) attachTo(server, sharedUpgradeListener);
+	else if (https) {
+		ownedServer = createServer$1(https);
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	} else {
+		ownedServer = createServer((_req, res) => {
+			res.writeHead(426, { "content-type": "text/plain" });
+			res.end("Upgrade Required");
+		});
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	}
+	const activeServer = server ?? ownedServer;
+	function detachAll() {
+		for (const detachOne of [...attachments]) detachOne();
+	}
+	return {
+		ws,
+		ready,
+		address: () => activeServer?.address() ?? null,
+		handleUpgrade: sharedUpgradeListener,
+		attach: (target) => attachTo(target, sharedUpgradeListener),
+		detach: detachAll,
+		async close() {
+			detachAll();
+			ws.closeAll(void 0, void 0, true);
+			if (ownedServer) {
+				const srv = ownedServer;
+				await ready.catch(() => {});
+				if (!srv.listening) return;
+				await new Promise((r) => srv.close(() => r()));
+			}
+		}
+	};
+}
+//#endregion
+export { isLoopbackHostname as a, isAllowedOrigin as i, createWsOriginRegistry as n, createRpcSessionMeta as o, createWsRpcPeerHooks as r, attachWsRpcTransport as t };

package/dist/{ws-server-uKQcClcJ.d.mts → ws-server-D1d3QM9f.d.mts}

@@ -1,14 +1,62 @@
-import { v as RpcFunctionDefinitionAny } from "./types-CnJSgRVa.mjs";
-import { Peer } from "crossws";
+import { v as RpcFunctionDefinitionAny } from "./types-Djq7CBXh.mjs";
 import { BirpcGroup, ChannelOptions } from "birpc";
+import { Hooks, Peer } from "crossws";
 import { NodeAdapter } from "crossws/adapters/node";
-import { Server } from "node:http";
+import { Buffer } from "node:buffer";
+import { IncomingMessage, Server } from "node:http";
 import { Server as Server$1, ServerOptions } from "node:https";
 import { AddressInfo } from "node:net";
-//#region src/rpc/transports/ws-server.d.ts
+import { Duplex } from "node:stream";
+//#region src/rpc/transports/session.d.ts
+/**
+ * Which wire transport produced an RPC connection. Every transport speaks
+ * the same birpc channel protocol; the kind only matters to code that needs
+ * transport-specific behavior (e.g. reaching the WS escape hatch on
+ * {@link DevframeRpcConnection.peer}).
+ */
+type DevframeRpcTransportKind = 'websocket' | 'sse';
+/**
+ * Structural view of the connect-time HTTP request behind an RPC connection
+ * — the WS upgrade request, or the request opening an SSE stream. Shaped to
+ * match both the web `Request` a crossws peer exposes and a plain
+ * `node:http` request wrapper, so auth hooks can read the bearer-token
+ * query param and the `Origin` header without caring which transport (or
+ * runtime) produced the connection.
+ */
+interface DevframeRpcConnectionRequest {
+  /** Request URL (may be path-only, e.g. `/__ws?devframe_auth_token=…`). */
+  url?: string;
+  /** Header lookup, `Headers`-style. */
+  headers?: {
+    get: (name: string) => string | null | undefined;
+  };
+}
+/**
+ * A live RPC connection, independent of the transport that carries it. One
+ * exists per connected client; transport bindings construct it alongside the
+ * session meta and hand both to the connect/disconnect hooks
+ * (`onPeerConnect` / `onPeerDisconnect`, {@link DevframeAuthHandler.onConnect}).
+ */
+interface DevframeRpcConnection {
+  /** Session id — the same value as the session meta's `id`. */
+  id: number;
+  /** The transport carrying this connection. */
+  transport: DevframeRpcTransportKind;
+  /** The connect-time HTTP request (upgrade request / stream request). */
+  request?: DevframeRpcConnectionRequest;
+  /** Send a raw wire frame to this client. Prefer the birpc channel. */
+  send?: (data: string) => void;
+  /** Terminate the connection from the server side. */
+  close?: (code?: number, reason?: string) => void;
+  /**
+   * The crossws peer backing a `websocket` connection — the WS-specific
+   * escape hatch (pub/sub, raw socket access). Absent on other transports.
+   */
+  peer?: Peer;
+}
 interface DevframeNodeRpcSessionMeta {
   id: number;
-  /** The crossws peer backing this session's socket. */
+  /** The crossws peer backing this session's socket (WS transport only). */
   peer?: Peer;
   clientAuthToken?: string;
   isTrusted?: boolean;
@@ -26,6 +74,8 @@ interface DevframeNodeRpcSessionMeta {
    */
   uploadingStreams?: Set<string>;
 }
+//#endregion
+//#region src/rpc/transports/ws-server.d.ts
 interface WsRpcTransportOptions {
   /**
    * Attach to an existing HTTP(S) server, sharing its port. Combine with
@@ -43,12 +93,20 @@ interface WsRpcTransportOptions {
   /** Host for the standalone WebSocket server. Defaults to `localhost`. */
   host?: string;
   /**
-   * Restrict the WS endpoint to a single upgrade route (e.g. `/__devframe_ws`). When
+   * Restrict the WS endpoint to a single upgrade route (e.g. `/__ws`). When
    * sharing a `server`, non-matching upgrade requests are left untouched for
    * other listeners to handle, so devframe's socket can sit alongside
    * framework sockets (Vite HMR, etc.).
    */
   path?: string;
+  /**
+   * Create the adapter without binding it to anything: no server is created,
+   * no port is bound, no `upgrade` listener is installed. The caller drives
+   * the socket itself through {@link WsRpcTransport.handleUpgrade} (from its
+   * own `upgrade` listener) or {@link WsRpcTransport.attach} (to bind a
+   * server later). Takes precedence over `server` / `port` / `https`.
+   */
+  unbound?: boolean;
   /**
    * Destroy upgrade requests that don't match `path` instead of leaving them
    * for other listeners. Enable this when devframe owns the shared server
@@ -76,8 +134,8 @@ interface WsRpcTransportOptions {
    * loses dev-time validation for `jsonSerializable: true` declarations.
    */
   definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-  onConnected?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
-  onDisconnected?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
+  onConnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
+  onDisconnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
   /** Override the default per-call serializer. Most callers should leave this unset. */
   serialize?: ChannelOptions['serialize'];
   /** Override the default per-call deserializer. Most callers should leave this unset. */
@@ -114,6 +172,20 @@ interface WsRpcTransport {
   ready: Promise<void>;
   /** Returns the bound address, or `null` when the server is not listening. */
   address: () => AddressInfo | string | null;
+  /**
+   * Complete a `node:http` `upgrade` event on this transport, applying the
+   * same `path` filter and origin gate the transport's own listener uses.
+   * Wire it into a host server directly — `server.on('upgrade',
+   * transport.handleUpgrade)` — or call it from an existing listener.
+   */
+  handleUpgrade: (req: IncomingMessage, socket: Duplex, head: Buffer) => void;
+  /**
+   * Route a server's `upgrade` events to this transport, returning a detach
+   * function. Use it to bind an `unbound` transport once the host server
+   * exists; {@link WsRpcTransport.close} detaches every server attached this
+   * way (without closing them — the caller owns their lifecycle).
+   */
+  attach: (server: Server | Server$1) => () => void;
   /** Remove the upgrade listener from a shared `server` (a no-op otherwise). */
   detach: () => void;
   /**
@@ -132,6 +204,15 @@ declare function isLoopbackHostname(hostname: string): boolean;
  * browser — is rejected.
  */
 declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
+/**
+ * The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
+ * any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
+ * feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
+ * fetch-upgrade adapter) reuse the same hooks so every transport speaks the
+ * identical wire protocol — one birpc channel per peer, per-method
+ * `jsonSerializable` dispatch between strict JSON and structured-clone.
+ */
+declare function createWsRpcPeerHooks<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: Pick<WsRpcTransportOptions, 'onConnected' | 'onDisconnected' | 'definitions' | 'serialize' | 'deserialize'>): Partial<Hooks>;
 /**
  * Attach a WebSocket transport to an existing RPC group, powered by
  * [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
@@ -144,4 +225,4 @@ declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: rea
  */
 declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
 //#endregion
-export { WsRpcTransportOptions as a, isAllowedOrigin as c, WsRpcTransport as i, isLoopbackHostname as l, DevframeNodeRpcSessionMeta as n, attachWsRpcTransport as o, WsOriginRegistry as r, createWsOriginRegistry as s, CreateWsOriginRegistryOptions as t };
+export { attachWsRpcTransport as a, isAllowedOrigin as c, DevframeRpcConnection as d, DevframeRpcConnectionRequest as f, WsRpcTransportOptions as i, isLoopbackHostname as l, WsOriginRegistry as n, createWsOriginRegistry as o, DevframeRpcTransportKind as p, WsRpcTransport as r, createWsRpcPeerHooks as s, CreateWsOriginRegistryOptions as t, DevframeNodeRpcSessionMeta as u };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.8.2",
-  "description": "Framework for building generic devframes",
+  "version": "0.9.0-beta.10",
+  "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
   "homepage": "https://github.com/devframes/devframe#readme",
@@ -22,23 +22,25 @@
     ".": "./dist/index.mjs",
     "./adapters/build": "./dist/adapters/build.mjs",
     "./adapters/cac": "./dist/adapters/cac.mjs",
-    "./adapters/cli": "./dist/adapters/cli.mjs",
     "./adapters/dev": "./dist/adapters/dev.mjs",
     "./adapters/embedded": "./dist/adapters/embedded.mjs",
     "./adapters/mcp": "./dist/adapters/mcp.mjs",
     "./client": "./dist/client/index.mjs",
     "./constants": "./dist/constants.mjs",
-    "./helpers/vite": "./dist/helpers/vite.mjs",
+    "./initiate": "./dist/adapters/initiate.mjs",
+    "./internal": "./dist/internal/index.mjs",
     "./node": "./dist/node/index.mjs",
     "./node/auth": "./dist/node/auth.mjs",
     "./node/hub-internals": "./dist/node/hub-internals.mjs",
     "./recipes/common-rpc-functions": "./dist/recipes/common-rpc-functions.mjs",
     "./recipes/interactive-auth": "./dist/recipes/interactive-auth.mjs",
-    "./recipes/open-helpers": "./dist/recipes/open-helpers.mjs",
     "./rpc": "./dist/rpc/index.mjs",
     "./rpc/client": "./dist/rpc/client.mjs",
     "./rpc/dump": "./dist/rpc/dump.mjs",
     "./rpc/server": "./dist/rpc/server.mjs",
+    "./rpc/transports/sse-client": "./dist/rpc/transports/sse-client.mjs",
+    "./rpc/transports/sse-server": "./dist/rpc/transports/sse-server.mjs",
+    "./rpc/transports/ws-bun": "./dist/rpc/transports/ws-bun.mjs",
     "./rpc/transports/ws-client": "./dist/rpc/transports/ws-client.mjs",
     "./rpc/transports/ws-server": "./dist/rpc/transports/ws-server.mjs",
     "./types": "./dist/types/index.mjs",
@@ -46,13 +48,14 @@
     "./utils/colors": "./dist/utils/colors.mjs",
     "./utils/crypto-token": "./dist/utils/crypto-token.mjs",
     "./utils/events": "./dist/utils/events.mjs",
+    "./utils/get-port": "./dist/utils/get-port.mjs",
     "./utils/hash": "./dist/utils/hash.mjs",
     "./utils/launch-editor": "./dist/utils/launch-editor.mjs",
     "./utils/nanoid": "./dist/utils/nanoid.mjs",
+    "./utils/nostics": "./dist/utils/nostics.mjs",
     "./utils/open": "./dist/utils/open.mjs",
-    "./utils/promise": "./dist/utils/promise.mjs",
+    "./utils/remote-assets": "./dist/utils/remote-assets.mjs",
     "./utils/simple-schema": "./dist/utils/simple-schema.mjs",
-    "./utils/scope": "./dist/utils/scope.mjs",
     "./utils/serve-static": "./dist/utils/serve-static.mjs",
     "./utils/shared-state": "./dist/utils/shared-state.mjs",
     "./utils/streaming-channel": "./dist/utils/streaming-channel.mjs",
@@ -87,9 +90,8 @@
   },
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
-    "birpc": "^4.0.0",
+    "birpc": "^4.1.0",
     "crossws": "^0.4.10",
-    "destr": "^2.0.5",
     "h3": "^2.0.1-rc.26",
     "mrmime": "^2.0.1",
     "nostics": "^1.2.0",
@@ -101,12 +103,11 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0",
     "get-port-please": "^3.2.0",
-    "immer": "^11.1.15",
+    "immer": "^11.1.16",
     "launch-editor": "^2.14.1",
     "mlly": "^1.8.2",
     "obug": "^2.1.4",
     "ohash": "^2.0.11",
-    "open": "^11.0.0",
     "p-limit": "^7.3.1",
     "perfect-debounce": "^2.1.0",
     "structured-clone-es": "^2.0.1",
@@ -115,7 +116,7 @@
     "ua-parser-modern": "^0.1.1",
     "valibot": "^1.4.2",
     "whenexpr": "^0.1.2",
-    "ws": "^8.21.2"
+    "ws": "^8.21.3"
   },
   "scripts": {
     "build": "tsdown",